build(migrations): 固化 OIDC 迁移安全复核

为已进入主干且会重建约束的 OIDC 迁移增加 SHA-256 锁定的精确规则豁免，文件内容或违规类型变化时仍会拒绝发布。生产只读预检确认受影响表规模很小，现有 6 条身份配置均为 schema v1，OIDC 会话和撤销水位均为空；新增校验器测试覆盖允许项和校验和篡改。
2026-07-29 16:19:00 +08:00
parent 9e4fc7362d
commit 39b1541fa1
3 changed files with 130 additions and 3 deletions
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "migrations": {
+    "apps/api/migrations/0090_oidc_multi_tenant_identity.sql": {
+      "sha256": "d5e67a0f92f4fe5fb64f5caceef0dd4733dc65f921e309bf4b3288522f6b4876",
+      "allowedViolations": [
+        "destructive DROP operation",
+        "non-null column addition"
+      ],
+      "reason": "The migration replaces two existing constraints and one index with expanded definitions. Production preflight confirmed six schema-v1 identity revisions, no OIDC sessions or revocation watermarks, and small affected relations; the non-null columns use constant defaults."
+    }
+  }
+}